Key takeaways
- Protect against failures of power, cooling and other utilities.
- Power, cooling and connectivity failures can take systems down as surely as an attack.
- Start here: identify supporting utilities your systems depend on.
Purpose
Protect against failures of power, cooling and other utilities.
Requirement
Requirement summaryInformation processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities.
Why it matters
Power, cooling and connectivity failures can take systems down as surely as an attack.
How to implement
- Identify supporting utilities your systems depend on.
- Provide resilience such as UPS, generators or redundant links where justified.
- Maintain and test utilities.
- Rely on provider assurances for cloud-hosted systems and check them.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.11. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your requirements for power, cooling and internet connections for key equipment.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.11 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Test and maintenance records for backup power and cooling.
- Records of past outages and the response.
- If you use a data centre or cloud provider, their reports covering these protections.
Things you should be able to show or explain
- Be able to show protections in your equipment room, if you have one.
How much to show: The last test of each protection.
Common mistakes
- Backup power never tested.
- Single points of failure not identified.
- UPS batteries never tested.
- Single internet connection for critical operations.
- Tip: UPS for critical kit; test it.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.11 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.11?
Be ready to explain how the control works in your organisation and to provide things like: Your requirements for power, cooling and internet connections for key equipment…